Data processing agreement

Version 2026-10-14

Parties. This agreement is concluded between {seller_legal_name}, {seller_address}, registration number {seller_registration_number} (the seller, you) and Unworn i.o., pending registration, Chamber of Commerce pending registration, which operates the platform under the name Unworn (the platform, we). Unworn i.o. is a company in formation. Its founders act as its representatives and the company ratifies this agreement on incorporation.

Acceptance. The person who registers your organisation as a seller accepts this agreement on its behalf at registration, together with the platform terms and before any connection is made or file is uploaded. The version, the person and the moment are recorded.

Language. This agreement exists in Dutch, English, German, French, Spanish and Italian. If the versions differ, the English text prevails.

Contact. [email protected]

Article 1. Definitions and parties

1.1 Words the General Data Protection Regulation (GDPR) defines have the meaning it gives them.

1.2 In this agreement the following words have the following meaning.

• Platform terms: the platform terms you accepted at registration, in the version that applies to you.
• Connection: a link between the platform and one of your systems, or an upload of a file, through which we read your data. Shopify, an ERP, a warehouse system and a CSV or XLSX file are each a connection.
• Connected data: everything we read or receive through a connection.
• Raw payload: a record as received from a connection, before we map it.
• Normalised data: connected data after we map it into the platform's own tables.
• Records: the decision records, decision narratives, transaction documents and audit trail the platform writes, as the platform terms describe.
• Sub processor: a party we engage to process connected data on our behalf.

1.3 For the connected data you are the controller and we are the processor. This agreement is the contract that article 28(3) GDPR requires.

1.4 For the data our privacy policy describes (your users' accounts, your organisation's contact details, purchase orders, invoices and the records) we are the controller. The privacy policy governs that processing, not this agreement.

Article 2. Subject matter, duration and nature of the processing

2.1 We process the connected data to analyse your stock, to produce the recommendations with the arithmetic behind them and the offer drafts that follow, and to write the records of what was recommended and what you decided.

2.2 The processing consists of reading a connection, storing the raw payloads, mapping them into normalised data, computing the signals and recommendations, composing offer drafts and writing the records. A language model proposes column mappings, offer drafts and narratives; a person confirms them. No number in a recommendation comes from a model.

2.3 The processing starts when you make a connection or upload a file, lasts as long as the connection exists, and ends with the return and deletion in article 12.

2.4 We are an agent between you and a buyer. We never own, hold, buy or sell goods, and money paid for goods never touches our own bank account. Nothing in this agreement changes that.

Article 3. Categories of data subjects and data

3.1 Data subjects: your customers, only as the pseudonymous identifiers your systems assign to them; contact persons at your wholesale customers, suppliers and warehouse where they appear in order or stock data; and members of your own staff whose names or work contact details appear in the connected data.

3.2 Data: orders and sales lines with a customer identifier; stock levels and movements; prices, costs and margins; product data (SKU, EAN, sizes, composition, origin, season, photos); and the work contact details of the persons in article 3.1.

3.3 We do not ask for and do not knowingly process names, addresses, mail addresses or payment details of your consumers. Where a raw payload carries more than we map, the surplus is deleted with the payload under article 12.1.

3.4 No special categories of personal data (article 9 GDPR) and no data about criminal convictions are processed under this agreement. You do not connect or upload such data.

Article 4. Instructions

4.1 We process the connected data only on your documented instructions: this agreement, the platform terms and your actions in the portal, such as making a connection, uploading a file, confirming a column mapping, confirming or changing a recommendation, placing an offer, exporting or erasing data.

4.2 We process the connected data only for the analysis, the recommendations, the offer drafts and the records. We do not use it for any other purpose, do not sell it and do not share it with another brand. Anonymised, aggregated transaction outcomes serve as benchmark data under the platform terms only where at least five transactions underlie a figure.

4.3 We inform you if in our view an instruction infringes the GDPR or other Union or Member State data protection law, and we may suspend the instruction until the matter is settled.

4.4 We inform you before we start any processing that Union or Member State law requires of us, unless that law forbids the notice on important grounds of public interest.

Article 5. Confidentiality and staff

5.1 Every person who works for us and has access to the connected data is bound by a written or statutory duty of confidentiality and has been instructed in this agreement.

5.2 Access to the connected data is limited to the persons who need it for the work in article 2. Every view of a reserve and every access to a connection's credentials is logged with the person and the moment, our own staff included.

5.3 We keep the fact that you use the platform and the content of your connected data confidential.

Article 6. Security measures

6.1 We take the technical and organisational measures in Annex 2. They give a level of security appropriate to the risk, taking into account the state of the art, the cost of implementation and the nature of the connected data.

6.2 We may replace a measure with one that gives equal or higher security, and update Annex 2 with the next version of this agreement.

6.3 To the extent the processing allows, we assist you with your own security obligation, your data protection impact assessments and any prior consultation of the supervisory authority under articles 32 to 36 GDPR.

Article 7. Sub processors

7.1 You authorise the sub processors in Annex 1. Each is bound by a written agreement that imposes the same data protection obligations this agreement imposes on us. We remain fully liable to you for a sub processor's performance.

7.2 We inform you by mail at least 30 days before we add or replace a sub processor, naming the party, its country and what it does.

7.3 You may object within that period on reasonable grounds relating to data protection. If we cannot offer an alternative before the change takes effect, you may end the connection concerned without cost, and where the new sub processor serves every connection, this agreement. Ending follows article 12.

7.4 Annex 1 also names two parties that are not sub processors, for clarity: the payment institution, an independent controller for the payment, and Shopify, the source of a connection.

Article 8. Assistance with data subject requests

8.1 To the extent the processing allows, we assist you with appropriate technical and organisational measures in answering requests by data subjects under chapter III GDPR.

8.2 A request we receive directly from a data subject about the connected data is forwarded to you without undue delay. We do not answer it ourselves unless you instruct us to.

8.3 For a Shopify connection, Shopify sends us three compliance requests. We handle them as follows and log every one.

• customers/data_request: we report to you the pseudonymous customer identifier concerned and the order lines it appears on. Nothing else exists.
• customers/redact: we null the pseudonymous customer identifier on the sales lines concerned and remove it from the matching raw payloads.
• shop/redact, sent after you uninstall the app: we revoke the connection, destroy its credentials and delete its raw payloads.

8.4 Normalised data, the recommendations and the records carry no customer identifier and survive the three requests. Normalised data is erased only through the action in article 12.5.

Article 9. Personal data breach

9.1 We inform you of a personal data breach affecting the connected data without undue delay and in any case within 48 hours after we discover it, at the mail address of your organisation's owners.

9.2 The notice describes the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; our contact person; the likely consequences; and the measures taken or proposed, including those that mitigate the effects. What is not available at once follows in phases without undue further delay.

9.3 We assist you with your notification to the supervisory authority and, where required, to the data subjects, and notify neither on your behalf unless you instruct us to. We document every breach, its effects and the remedial action, and make that documentation available to you.

Article 10. Audits

10.1 We make available to you all information necessary to demonstrate compliance with article 28 GDPR and with this agreement.

10.2 Once a year, on request, you may audit our compliance. The audit starts with a written questionnaire, which we answer within a reasonable period. Where the answers are insufficient, you or an independent auditor bound by confidentiality may audit on site, at your cost, during business hours, on at least 30 days notice, without disrupting our operations and without access to another organisation's data.

10.3 An audit a supervisory authority requires, or that follows a personal data breach, does not count against the yearly audit.

Article 11. Transfers outside the EEA

11.1 The connected data is stored and processed in the European Union. Annex 1 names the country of every sub processor.

11.2 Three sub processors in Annex 1 are established in the United States. Mailgun and Sentry process on EU infrastructure through the EU endpoint and EU ingest and receive no connected data. Anthropic PBC receives the limited input in Annex 2, point 7. Inference is pinned to the EU region the provider offers and the provider does not train on our data. The transfer of what reaches the provider rests on the standard contractual clauses adopted by the European Commission and on the provider's certification under the EU US Data Privacy Framework. The same clauses cover the two other United States parties for any access from outside the EEA.

11.3 We make no other transfer outside the EEA, and no onward transfer, without your prior written instruction and a valid transfer mechanism.

Article 12. Retention, return and deletion

12.1 Raw payloads are deleted 180 days after we receive them, or earlier under article 8.3.

12.2 Normalised data is kept for the life of the connection. It carries no customer identifier other than the pseudonymous one in article 3.1.

12.3 When a connection or this agreement ends, you export your normalised data, recommendations and records through the export in the portal. After your export, or when you tell us you do not need one, we delete the connection's normalised data and credentials. The end of your account under the platform terms has the same effect for every connection.

12.4 We retain the records as controller for our own duties: five years from creation for decision records, narratives and the audit trail, configurable per country where the law requires longer, and seven years for invoices and the transaction documents behind them under Dutch fiscal law. They are not deleted inside the period, not even when your account ends. Personal data of your users is removed from them where that does not weaken the evidence. They carry no customer identifier.

12.5 You can ask us at any time to erase everything we ingested from a connection: its raw payloads and the normalised data sourced from it. It is a deliberate action with its own confirmation, logged with the reason, and the only path that reaches normalised data. It does not erase the records in article 12.4; the confirmation says so before you confirm.

12.6 Deletion reaches our live systems at once and the backups when the backup cycle in Annex 2 completes. We confirm a deletion in writing on request.

Article 13. Liability

13.1 The liability of each party under this agreement is governed by the liability article of the platform terms, including its cap and its exclusion of indirect and consequential loss. Nothing in this agreement limits the liability the GDPR imposes on a party towards a data subject or a supervisory authority.

13.2 Each party bears an administrative fine imposed for its own infringement. A party that pays a fine or compensation for an infringement by the other party may recover the amount from that party within the cap in article 13.1.

Article 14. Term, precedence and law

14.1 This agreement applies from acceptance for as long as you have a connection or connected data on the platform, and afterwards until the return and deletion in article 12 are complete. Articles 5, 12, 13 and 14 survive its end.

14.2 We may change this agreement on 30 days notice by mail. Continued use of a connection after the notice period is acceptance. If you do not accept, you may end the connection under article 12.

14.3 On questions of the processing of connected data this agreement prevails over the platform terms. On every other question the platform terms prevail.

14.4 This agreement is governed by Dutch law. The Rechtbank Amsterdam has exclusive jurisdiction over every dispute arising from it.

Annex 1. Sub processors

Party	Country	Purpose	Data concerned
Hetzner Online GmbH	Germany, Finland where used (EU)	Hosting of the platform, the database and the backups	All connected data, encrypted at rest
Anthropic PBC	United States, EU inference region	Language model calls for column mapping, offer drafts and narratives; no training on our data; SCCs and EU US Data Privacy Framework	The input in Annex 2, point 7, with your name removed
Mailgun (Sinch), EU endpoint	United States, data stored in the EU	Transactional mail to your users	Mail address and the content of the notice; no connected data
Functional Software Inc., trading as Sentry, EU ingest	United States, data stored in the EU	Error monitoring, 90 days	Organisation and user identifiers only; no names, mail addresses, request bodies or connected data
ScrapingBee SAS	France (EU)	Fetching a public product page on our behalf when the page's host refuses our own reader (ADR 0076); only for pages a seller names for its products	The public address of that page; no connected data, no name, no login

Two parties listed for clarity, not as sub processors:

Party	Country	Role
Online Payment Platform B.V., Delft	Netherlands	Payment institution licensed by De Nederlandsche Bank; independent controller for the payment and its own customer verification; receives no connected data
Shopify International Ltd	Ireland	Source of a connection you authorise; sends the compliance requests in article 8.3; receives nothing from us beyond the operation of the app

Annex 2. Security measures

1. EU hosting and encryption. The platform, its database and its backups run at the hosting sub processor in Annex 1. Data is encrypted in transit; the database and the backups are encrypted at rest.
2. Encrypted credentials. The credentials of every connection are stored encrypted with a key the application holds and the database does not. They never appear in logs, error reports or exports.
3. Role and organisation scoping. The seller portal, the buyer portal and the internal console have separate authentication. Every table that holds your data carries your organisation identifier and every portal query is scoped to it. Owners and members in your organisation have the rights you assign.
4. Append only audit and decision logs. Every state change, every manual decision by our staff with its reason, every view of a reserve and every export is written to an audit log the application cannot update or delete; the database enforces it. Decision records and narratives are append only in the same way.
5. No raw rows or sample values in logs. Logs and error reports never contain a raw payload, a data row, a sample value, a credential or a reserve. A list of forbidden keys is applied to every event before it leaves the platform.
6. Error monitoring with identifiers only. Error reports carry the organisation, user and process identifiers, never a name, a mail address, a request body or a query value, and are kept 90 days at the error monitoring sub processor in the EU.
7. The language model sampling rule. Column mapping sends headers, inferred types and at most ten sample values per column, never from revenue, customer or margin columns, with your name removed. Offer drafts and narratives send the aggregated fields of one record, never rows of sales data. No call contains the data of two organisations. We store a hash of the input and the proposal, never the input. A person confirms every proposal before it touches your data.
8. Backups. Backups are taken on a fixed schedule, stored encrypted in the EU and overwritten in a fixed cycle. Restores are tested.
9. Access and change management. Access to production is personal, uses multi factor authentication, is limited to the persons who need it and is revoked when a person leaves. Changes are reviewed and tested before release; security tests assert that one organisation's data never reaches another portal.
10. Breach procedure. A documented procedure covers detection, containment, assessment and the notice in article 9.